Washington state limits Stingray surveillance in unanimously approved ‘pro-privacy’ law

An anti-surveillance bill that brings unprecedented restrictions to cell phone tracking technology, not unlike that achieved through devices sold as “Stingrays,” has been signed into law in Washington state.

Governor Jay Inslee, a Democrat, added his signature to HB 1440
on Monday this week, authorizing a law that effective immediately
requires police officers to obtain search warrants before
deploying “cell site simulators,” or devices that mimic the
behavior of mobile phone towers.

Dozens of law enforcement agencies across the United States rely
on simulators like these that are branded as “Stingrays” by
Harris Corp., a Florida-based manufacturer, to try to locate
persons of interest through cell phone signal triangulation.
Revelations concerning both the technology behind the tools and
the rules for using them have emerged in recent months, however,
and in turn attracted criticism from privacy advocates and
transparency proponents alike. Now amid increased attention, this
controversial but little-known technology, civil libertarians say
Governor Inslee’s signing has put in place rules to protect the
innocent that are absent anywhere else in the US.

“Stingrays are emblematic of the threats to privacy posed by
new technologies and expanding government surveillance
activities. The new law makes Washington state a leader in
regulating these invasive devices,” Jared Friend, the
director of the Technology and Liberty program at the American
Civil Liberties Union’s office in Washington, said in a statement.

Stingray bill passing is great, but not end of the road in WA.
Now on to working on more records requests and looking for
cases to help on.

The technology behind the Stingray allows authorities to collect
information about upwards of thousands of mobile devices within a
given area by emulating the legitimate signals sent by cell
towers like those run by phone companies. Phones will
automatically try to connect to a “cell site simulator” when
within range, and police can use data sent by those devices to
attempt to pinpoint the location of a suspect.

Since simulators like the Stingray gather data on more than just
the targeted device, privacy proponents have cried foul as more
details surface about a technology that until recently was
shrouded in secrecy. Reports have indicated that the Baltimore
Police Department in Maryland used Stingrays thousands of times during the last decade
without search warrants. Contracts obtained through Freedom of
Information Act requests have revealed that police agencies are
told to drop charges in which evidence is obtained through the
technology instead of having to disclose its existence. In
Washington, just last year it was found that the Tacoma Police
Department used simulators for more than five years without
acknowledgment.

Amid increased scrutiny, the US Department of Justice said
earlier this month that it would be undertaking a federal
investigation on the use of cell site simulators, and many
jurisdictions have weighed in and in some instances approved
restrictions on the tools. According to experts, Washington State
now has the strictest Stingray rules in the country.

Effective from Monday, a warrant has to be obtained from a judge
before a cell site simulator can be deployed within the state, in
accordance with the new law, and data collected by the devices
that aren’t pertinent to the investigation must be deleted or
limited. Additionally, the measure requires police to provide
judges with specific details about simulators and how they will
be used in each instance, providing a rare paper trail with
regards to technology that is usually obfuscated by
non-disclosure agreements, according to past reports.

Police in Washington state have until now been generally required
to obtain a court order to use a Stingray, but the new law goes a
step further and says investigators must demonstrate probable
cause.

“I don’t think our judicial system works if judges and those
being charged don’t have a view into law enforcement activities
that put them in the position that they’re in,” the ACLU of
Washington’s Friend told the Tri-City Herald. Because of the
bill, Friend said, “Criminal defendants will also have access
to the court orders that are required justifying the use of the
Stingray.”

Chris Soghoian, the principal technologist for the ACLU’s
national Speech, Privacy and Technology department, wrote on
Twitter that the governor’s signature this week established
“the most pro-privacy Stingray law in the country.”

The state house passed the bill by a vote of 97-0 in April, and
it saw similar unanimous approval in the Senate one month later
before ending up on the governor’s desk on Monday.

The governor’s signing of HB 1440 on Monday is far from being the
biggest win for privacy proponents nationwide as of late; last
week, a federal appeals court said that the National Security
Agency is not authorized under the Patriot Act to collect phone
records of Americans on a daily basis, putting into question the
future of the NSA program exposed by former contractor Edward
Snowden in 2013.